Privacy Policy

1. Who we are and what this policy covers

The website at pipo.vc (the "Site"), including its pre-IPO page and waitlist, is operated by PIPO CAPITAL MARKETS, S.A. DE C.V., registration no. 2026133627, Avenida El Espino, Centro Comercial Estacion del Casco, Tercer Nivel, StofficeCenter #42, Colonia San Benito, San Salvador, El Salvador ("PIPO", "we", "us", "our"). We are the controller of the personal data described in this policy.

This policy explains what information the Site collects, what it is used for, who else receives it, how long we keep it, and the rights you have. The PIPO platform at app.pipo.vc is a separate service of the same company; its own privacy notice, shown in the platform, applies there. Where this policy says that something is shared with the platform, that is explained below.

Where consent is required, for analytics cookies and similar technologies or for e-mail updates, we ask for it separately and you can withdraw it at any time.

2. Information we collect

2.1 Information you give us

• E-mail address - when you join the waitlist on the pre-IPO page. Nothing else is asked for on that form.
• Messages - when you write to support@pipo.vc or business@pipo.vc, including the "Investing more than $25,000?" button on a deal page, which opens your own e-mail program: we receive what you send and the address you send it from.

2.2 Information collected automatically, only with your consent

If you accept analytics in the cookie banner, our analytics tools (PostHog and Google Analytics, section 4) collect:

• Usage data - the pages you open, the sections of a page you scroll to and how far you scroll, the links, buttons and cards you click (with their visible text), the language you choose, the videos you play, and, on a deal page, that you used the investment calculator. Amounts you type into the calculator are reported only as a range (for example $500 to $2,499), never as the exact figure.
• Device and browser data - browser type and version, operating system, screen size and device class (phone, tablet, desktop), and page-load and performance timings.
• Where you came from - the website that referred you (its domain only), and any campaign tags on the address you arrived at (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid).
• Session recordings - PostHog can record a replay of how a page was used: mouse movement, scrolling, clicks and the layout of the page as it changed. All text on the page and everything you type are masked in your browser before anything is sent, images are not recorded, and the content of network requests is not recorded. Browser console messages and technical errors on the page are included, so that we can find and fix faults.
• An anonymous identifier - a random identifier stored in a cookie so that visits from the same browser can be counted as one visitor. It is not linked to your name or e-mail on this Site; see section 4 for what happens if you later create an account on the PIPO platform.
• Approximate location - country and region, derived by the analytics providers from your IP address. The Site does not store your IP address in analytics.

2.3 Information collected regardless of consent

• Server logs - our hosting provider (Vercel) records the IP address, browser identification, requested address and time of every request for security and to keep the Site running, and keeps these logs for a short period.
• Referral code - if you arrive through a referral link (pipo.vc/r/<code> or a link with a ?ref= parameter), the code is stored in your browser for 90 days and passed on to the PIPO platform so that the person who referred you can be credited if you sign up. The code identifies the referrer, not you.
• Your choices - the language of the Site and your cookie choice are stored in your browser so that we do not ask again.
• Bot check on the waitlist form - the form is protected by Cloudflare Turnstile, which processes your IP address and browser signals to tell people from automated scripts. Turnstile is part of the form only; nothing else on the Site uses it.

3. Cookies and browser storage

The Site uses the following cookies and browser storage. Analytics entries are created only after you accept analytics in the cookie banner.

Embedded third-party content

Some pages load content from other companies, which may set their own cookies and receive your IP address and browser information when it loads, under their own privacy policies:

• TradingView - the share-price chart on a deal page loads from TradingView when the page opens.
• YouTube - video previews on a deal page are loaded from YouTube's image servers when the page opens; the player itself, in YouTube's privacy-enhanced mode, loads only when you press play.
• Cloudflare Turnstile - the bot check inside the waitlist form on the pre-IPO page.

Analytics tools are not loaded and no request is made to PostHog or Google before you accept. If you decline, no analytics cookie is set and no analytics data is sent.

You can change your choice at any time with the "Cookie policy" link in the Site footer, which reopens the cookie banner, or by writing to support@pipo.vc. Withdrawing consent is as easy as giving it and does not affect what was collected before.

4. Analytics: PostHog and Google Analytics

With your consent we use two analytics services to understand how the Site is used and to improve it:

• PostHog (PostHog, Inc., United States; data stored in the US) - product analytics: the usage, device, source and session-recording data described in section 2.2, aggregated click positions (heatmaps), page performance and error reports. PostHog Privacy Policy
• Google Analytics 4 (Google LLC, United States) - traffic measurement: pages viewed, sessions, device and approximate location, with IP addresses anonymised. Google Privacy Policy

The PostHog identifier is stored in a cookie on the pipo.vc domain, which the PIPO platform at app.pipo.vc also reads, and the two use one PostHog project. On this Site you remain anonymous: we do not tie the identifier to a name or e-mail address. If you later register on the platform, the platform links the identifier to your account, so that the pages you viewed here before signing up can be associated with it. The platform's privacy notice describes that use.

Analytics events describe what was done on the Site, not who you are: they carry the page, the section, the control that was used, the device class, the language, the referring domain and campaign tags. They never carry the contents of forms, the exact amounts typed into the calculator, or your e-mail address.

We do not use analytics data for advertising, and we do not sell it.

5. The waitlist

When you join the waitlist on the pre-IPO page, your e-mail address is:

• stored in our waitlist database, together with the time of sign-up;
• checked against Cloudflare Turnstile before it is accepted, to keep automated sign-ups out;
• added to our address book at SendPulse, the service we send e-mail updates from; every update carries an unsubscribe link;
• if you arrived through a referral link, passed to the PIPO platform together with the referral code, so that the referrer is credited.

By joining you agree to receive updates about the launch and availability of PIPO's products. You can unsubscribe from any e-mail, or ask us to remove your address altogether at support@pipo.vc. The waitlist is managed by authorised staff only, through a password-protected internal page.

6. Referral links and campaign tags

A referral code that you arrive with is kept in your browser for 90 days and relayed once per visit to the PIPO platform, by a hidden request to app.pipo.vc, so that a referral still counts if you sign up there later. Campaign tags on the address you arrived at (utm_* and ad click identifiers) are kept for the tab's session and added to links from the Site into the platform, so that the platform can record where a sign-up came from. Neither the code nor the tags identify you; they identify a link or a campaign.

7. Why we process your data and on what basis

We process personal data for the following purposes and on the following lawful bases:

• Consent - analytics cookies and similar technologies, including session recordings, and e-mail updates to the waitlist. You may withdraw consent at any time.
• Performance of your request - to add you to the waitlist you asked to join, and to answer messages you send us.
• Legitimate interest - keeping the Site secure and available (server logs, bot protection), crediting referrals and measuring campaigns, and improving the Site. You have the right to object; see section 11.
• Legal obligation - where the law requires us to keep or disclose information.

8. Who receives your data

We share personal data only with the service providers that run parts of the Site for us, acting on our instructions, and with the PIPO platform as described above. They are:

• Vercel, Inc. (United States) - hosting and delivery of the Site; server logs. Vercel Privacy Policy
• PostHog, Inc. (United States) - product analytics and session recordings, after consent. PostHog Privacy Policy
• Google LLC (United States) - Google Analytics 4, after consent; YouTube for embedded videos. Google Privacy Policy
• Cloudflare, Inc. (United States, global network) - Turnstile bot check on the waitlist form. Cloudflare Privacy Policy
• our managed PostgreSQL database provider - storage of the waitlist.
• SendPulse - the e-mail service the waitlist updates are sent from. SendPulse Privacy Policy
• TradingView, Inc. (United States) - the share-price chart embedded on a deal page. TradingView Privacy Policy
• The PIPO platform at app.pipo.vc, operated by us - referral codes, campaign tags, the shared cookie choice and, for referred sign-ups, the waitlist e-mail address.

We may also disclose information where the law requires it, to protect our rights, or to a successor in a reorganisation of our business. We do not sell personal data and do not share it with third parties for their own marketing.

Several of these providers are located outside your country, including in the United States. Where data is transferred out of a jurisdiction with data-protection law, we rely on the safeguards available under that law, such as the providers' standard contractual clauses.

9. How long we keep your data

• Waitlist e-mail addresses: until the launch communications end, or until you unsubscribe or ask for removal, whichever comes first.
• Analytics events in PostHog: for as long as we run the analyses described in section 4, after which they are deleted or kept only in aggregated form. Session recordings are deleted automatically after the retention period of our PostHog plan, which is no longer than one year.
• Google Analytics: user- and event-level data is kept according to our Google Analytics settings, currently 2 months.
• Server logs: a short period set by our hosting provider.
• Cookies and browser storage: for the lifetimes in section 3, or until you clear them.
• Messages you send us: for as long as needed to answer them and to keep a record of our correspondence.

10. Security

The Site is served over encrypted connections (TLS), the waitlist database is accessed over encrypted connections and restricted to our servers, and the internal waitlist page requires a password. Analytics recordings mask all text and input in your browser before anything is sent. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to:

• ask what personal data we hold about you and receive a copy;
• have it corrected or deleted;
• withdraw consent for analytics or for e-mail updates at any time;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• ask us to restrict processing while a request is being considered;
• receive the data you gave us in a portable format;
• complain to a data-protection authority in your jurisdiction.

To exercise any of these rights, write to support@pipo.vc. We will answer within 30 days and may ask you to confirm that the request comes from the address concerned. We do not discriminate against anyone for exercising their rights.

12. Children

The Site is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@pipo.vc and we will delete it.

13. Changes to this policy

We may update this policy as the Site and the tools it uses change. The current version is always at pipo.vc/privacy with its date at the top. Where a change is material, we will make reasonable efforts to bring it to the attention of the people it affects.

14. Contact

Questions about this policy or about your data: support@pipo.vc, or by post to PIPO CAPITAL MARKETS, S.A. DE C.V., Avenida El Espino, Centro Comercial Estacion del Casco, Tercer Nivel, StofficeCenter #42, Colonia San Benito, San Salvador, El Salvador.